Claude's the winner. There's a caveat, but it's pretty interesting. It seems it kept traversing permissions until it hit a cycle of it going back to square one. it full mapped out all of the permissions. Codex did this same but not to this extent. Thats why there's "more" privsec opportunities. It identified role chaining, where none of the others were able to.